-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathBrokenAuth.php
233 lines (165 loc) · 12.2 KB
/
BrokenAuth.php
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
<!DOCTYPE html>
<html lang="en">
<head>
<title>Course - Elements</title>
<meta charset="utf-8">
<meta http-equiv="X-UA-Compatible" content="IE=edge">
<meta name="description" content="Course Project">
<meta name="viewport" content="width=device-width, initial-scale=1">
<link rel="stylesheet" type="text/css" href="styles/bootstrap4/bootstrap.min.css">
<link href="plugins/fontawesome-free-5.0.1/css/fontawesome-all.css" rel="stylesheet" type="text/css">
<link rel="stylesheet" type="text/css" href="styles/elements_styles.css">
<link rel="stylesheet" type="text/css" href="styles/elements_responsive.css">
<link rel="shortcut icon" type="image/x-icon" href="https://d1o5lmfp4gliop.cloudfront.net/assets/favicon-271ae300988b62ece3b4cf66c01c3e7009bfb65839edd064f199b990d3f89c4f.ico" />
<link rel="apple-touch-icon" href="/touch-icon-iphone.png">
<link rel="apple-touch-icon" sizes="76x76" href="/touch-icon-ipad.png">
<link rel="apple-touch-icon" sizes="120x120" href="/touch-icon-iphone-retina.png">
<link rel="apple-touch-icon" sizes="152x152" href="/touch-icon-ipad-retina.png">
<link rel="stylesheet" media="all" href="https://d1o5lmfp4gliop.cloudfront.net/assets/application-bf750350668fb68c7d1d54d4caacdcf06ec5a21e849fb24fc3212b8b29cda425.css" />
<script src="https://d1o5lmfp4gliop.cloudfront.net/assets/application-ad46a63ff8292fabd58fb815f242c430c3d7f4dbfdb933d05d137fa9d2ae07d5.js"></script>
<meta name="viewport" content="width=device-width, initial-scale=1">
<script>
var _rollbarConfig = {
accessToken: "7292cc33ae3843d4bc12aa01e4d82436",
captureUncaught: true,
payload: {
environment: "production"
}
};
!function(r){function o(e){if(t[e])return t[e].exports;var n=t[e]={exports:{},id:e,loaded:!1};return r[e].call(n.exports,n,n.exports,o),n.loaded=!0,n.exports}var t={};return o.m=r,o.c=t,o.p="",o(0)}([function(r,o,t){"use strict";var e=t(1).Rollbar,n=t(2);_rollbarConfig.rollbarJsUrl=_rollbarConfig.rollbarJsUrl||"https://d37gvrvc0wt4s1.cloudfront.net/js/v1.8/rollbar.min.js";var a=e.init(window,_rollbarConfig),i=n(a,_rollbarConfig);a.loadFull(window,document,!_rollbarConfig.async,_rollbarConfig,i)},function(r,o){"use strict";function t(r){return function(){try{return r.apply(this,arguments)}catch(o){try{console.error("[Rollbar]: Internal error",o)}catch(t){}}}}function e(r,o,t){window._rollbarWrappedError&&(t[4]||(t[4]=window._rollbarWrappedError),t[5]||(t[5]=window._rollbarWrappedError._rollbarContext),window._rollbarWrappedError=null),r.uncaughtError.apply(r,t),o&&o.apply(window,t)}function n(r){var o=function(){var o=Array.prototype.slice.call(arguments,0);e(r,r._rollbarOldOnError,o)};return o.belongsToShim=!0,o}function a(r){this.shimId=++s,this.notifier=null,this.parentShim=r,this._rollbarOldOnError=null}function i(r){var o=a;return t(function(){if(this.notifier)return this.notifier[r].apply(this.notifier,arguments);var t=this,e="scope"===r;e&&(t=new o(this));var n=Array.prototype.slice.call(arguments,0),a={shim:t,method:r,args:n,ts:new Date};return window._rollbarShimQueue.push(a),e?t:void 0})}function l(r,o){if(o.hasOwnProperty&&o.hasOwnProperty("addEventListener")){var t=o.addEventListener;o.addEventListener=function(o,e,n){t.call(this,o,r.wrap(e),n)};var e=o.removeEventListener;o.removeEventListener=function(r,o,t){e.call(this,r,o&&o._wrapped?o._wrapped:o,t)}}}var s=0;a.init=function(r,o){var e=o.globalAlias||"Rollbar";if("object"==typeof r[e])return r[e];r._rollbarShimQueue=[],r._rollbarWrappedError=null,o=o||{};var i=new a;return t(function(){if(i.configure(o),o.captureUncaught){i._rollbarOldOnError=r.onerror,r.onerror=n(i);var t,a,s="EventTarget,Window,Node,ApplicationCache,AudioTrackList,ChannelMergerNode,CryptoOperation,EventSource,FileReader,HTMLUnknownElement,IDBDatabase,IDBRequest,IDBTransaction,KeyOperation,MediaController,MessagePort,ModalWindow,Notification,SVGElementInstance,Screen,TextTrack,TextTrackCue,TextTrackList,WebSocket,WebSocketWorker,Worker,XMLHttpRequest,XMLHttpRequestEventTarget,XMLHttpRequestUpload".split(",");for(t=0;t<s.length;++t)a=s[t],r[a]&&r[a].prototype&&l(i,r[a].prototype)}return r[e]=i,i})()},a.prototype.loadFull=function(r,o,e,n,a){var i=function(){var o;if(void 0===r._rollbarPayloadQueue){var t,e,n,i;for(o=new Error("rollbar.js did not load");t=r._rollbarShimQueue.shift();)for(n=t.args,i=0;i<n.length;++i)if(e=n[i],"function"==typeof e){e(o);break}}"function"==typeof a&&a(o)},l=!1,s=o.createElement("script"),u=o.getElementsByTagName("script")[0],p=u.parentNode;s.crossOrigin="",s.src=n.rollbarJsUrl,s.async=!e,s.onload=s.onreadystatechange=t(function(){if(!(l||this.readyState&&"loaded"!==this.readyState&&"complete"!==this.readyState)){s.onload=s.onreadystatechange=null;try{p.removeChild(s)}catch(r){}l=!0,i()}}),p.insertBefore(s,u)},a.prototype.wrap=function(r,o){try{var t;if(t="function"==typeof o?o:function(){return o||{}},"function"!=typeof r)return r;if(r._isWrap)return r;if(!r._wrapped){r._wrapped=function(){try{return r.apply(this,arguments)}catch(o){throw o._rollbarContext=t()||{},o._rollbarContext._wrappedSource=r.toString(),window._rollbarWrappedError=o,o}},r._wrapped._isWrap=!0;for(var e in r)r.hasOwnProperty(e)&&(r._wrapped[e]=r[e])}return r._wrapped}catch(n){return r}};for(var u="log,debug,info,warn,warning,error,critical,global,configure,scope,uncaughtError".split(","),p=0;p<u.length;++p)a.prototype[u[p]]=i(u[p]);r.exports={Rollbar:a,_rollbarWindowOnError:e}},function(r,o){"use strict";r.exports=function(r,o){return function(t){if(!t&&!window._rollbarInitialized){var e=window.RollbarNotifier,n=o||{},a=n.globalAlias||"Rollbar",i=window.Rollbar.init(n,r);i._processShimQueue(window._rollbarShimQueue||[]),window[a]=i,window._rollbarInitialized=!0,e.processPayloads()}}}}]);
</script>
<style>
.buttonx {
background-color: #4CAF50; /* Green */
border: none;
color: white;
padding: 15px 32px;
text-align: center;
text-decoration: none;
display: inline-block;
font-size: 16px;
margin: 4px 2px;
cursor: pointer;
}
.button2x {background-color: #ffb606;}
</style>
<script type="text/javascript">
function showMessage(){
alert("Try log in as a Guest and access the home page");
}
</script>
</head>
<body>
<div class="super_container">
<!-- Header -->
<header class="header d-flex flex-row">
<div class="header_content d-flex flex-row align-items-center">
<!-- Logo -->
<div class="logo_container">
<div class="logo">
<img src="images/logo.png" alt="">
<span>Dashboard</span>
</div>
</div>
<!-- Main Navigation -->
<nav class="main_nav_container">
<div class="main_nav">
<ul class="main_nav_list">
<li class="main_nav_item"><a href="news.php">home</a></li>
<li class="main_nav_item"><a href="courses.php">Modules</a></li>
<li class="main_nav_item"><a href="teachers.php">Lecturers</a></li>
<li class="main_nav_item"><a href="elements.php">Dashboard</a></li>
<li class="main_nav_item"><a href="shop.php">Ebooks</a></li>
</ul>
</div>
</nav>
</div>
<div class="header_side d-flex flex-row justify-content-center align-items-center">
<img src="images/phone-call.svg" alt="">
<form id="search_form" class="search_form" method="post" action="news.php">
<span class="label label-danger"><button id="contact_send_btn" name="form_logout" type="submit" class="buttonx button2x" value="Submit">Student Logout</button></span>
</form>
<?php
//unset($_SESSION['PHPSESSID']);
if ($_SERVER['REQUEST_METHOD'] === 'POST'){
if(isset($_POST['form_logout'])){
unset($_COOKIE["_usrLogged"]);
setcookie("_usrLogged", $_SESSION["user_cookie"], time() - (86400 * 2), "/", "",false,true);
session_unset();
session_destroy();
header('Location: index.php');
exit();
}
}
?>
</div>
<!-- Hamburger -->
<div class="hamburger_container">
<i class="fas fa-bars trans_200"></i>
</div>
</header>
<!-- Menu -->
<div class="menu_container menu_mm">
<!-- Menu Close Button -->
<div class="menu_close_container">
<div class="menu_close"></div>
</div>
<!-- Menu Items -->
<div class="menu_inner menu_mm">
<div class="menu menu_mm">
<ul class="menu_list menu_mm">
<li class="main_nav_item"><a href="news.php">home</a></li>
<li class="main_nav_item"><a href="courses.php">Modules</a></li>
<li class="main_nav_item"><a href="teachers.php">Lecturers</a></li>
</ul>
<!-- Menu Social -->
<div class="menu_social_container menu_mm">
<ul class="menu_social menu_mm">
<li class="menu_social_item menu_mm"><a href="#"><i class="fab fa-pinterest"></i></a></li>
<li class="menu_social_item menu_mm"><a href="#"><i class="fab fa-linkedin-in"></i></a></li>
<li class="menu_social_item menu_mm"><a href="#"><i class="fab fa-instagram"></i></a></li>
<li class="menu_social_item menu_mm"><a href="#"><i class="fab fa-facebook-f"></i></a></li>
<li class="menu_social_item menu_mm"><a href="#"><i class="fab fa-twitter"></i></a></li>
</ul>
</div>
</div>
</div>
</div>
<!-- Home -->
<!-- Elements -->
<!-- Buttons -->
<div class="loaders">
<div class="container">
<div class="row">
<div class="col">
<div class="elements_title"></div>
</div>
</div>
<div class="row elements_loaders_container">
</div>
</div>
</div>
<!-- Progress Bars and Accordions -->
<div class="container cards mandatory">
<!--paste here-->
<div class="main reading sql-injection">
<div class="container">
<div class="row prevention-tips has-sponsor">
<div class="row title modest">
Protecting Against Broken Authentication
</div>
<p><strong>Authentication</strong></a>.
plays a critical role in the security of web applications</p>
<p class="well"><strong>hen a user provides his login name and password to authenticate and prove his identity, the application assigns the user specific privileges to the system, based on the identity established by the supplied credentials.</strong></p>
<p><strong>What an Attacker can do if Your Site is Vulnerable?</strong></p>
<p>When the attacker breaks into the system by proving to the application that he is a known and valid user, the attacker gains access to whatever privileges the administrator assigned that user.
This means that if the attacker manages to enter as a normal user, he might have limited access to only view some important information. On the other hand, if he manages to enter as an administrative user with global access on the system, he would have almost total control on the application together with its content (with the limitations of the web application in itself).</p>
<p><strong>How to Protect from Broken Authentication based Attacks?</strong> </p>
<p>1.To verify whether an attack phase has succeeded or not, automated tools assess the returned error codes and page information from the host web server. A secure practice is to force any error or unexpected request to generate a HTTP 200 OK response, instead of the numerous 400 type errors. This will make it more difficult for the attacker to distinguish between valid and invalid login attempts.
An important measure in stopping automated brute-force authentication attacks is by adding random content on the page presented to the authenticating client browser. The client must be capable of successfully submitting this random content as part of the authentication process to proceed further in the web site or application. The best way to do this is to present the random phrase in a graphic GIF, JPG or PNG format using random fonts or colours each time. This can make it almost impossible for an automated process to succeed.</p>
<p>2.Check if your website is vulnerable to attack with Acunetix Web Vulnerability Scanner - Acunetix Web Vulnerability Scanner ensures website security by automatically checking for SQL injection, Cross site scripting, Authentication Hacking and other vulnerabilities. It checks password strength on authentication pages and automatically audits shopping carts, forms, dynamic content and other web applications. As the scan is being completed, the software produces detailed reports that pinpoint where vulnerabilities exist. Download the evaluation version today!</p>
</div>
</div>
</div>
</body>
</html>